this alert is from LFD (part of CSF). it means the account_user_name (538:535) runs a suspicious php script that is caught by lfd. you need to verify if the script indeed has any issue and deal with it (remove or something else). this has nothing to do with lsws.

We believe this is a conflict between lsws and maybe mode_sec or CSF, Because when we switch to apache will not receive this warning again!
We've already told you and told you it is time to upgrade lsws.